6 Commits (v4.3.0)

Author	SHA1	Message	Date
Ruslan Shaydullin	67d54fd880	fix(provenance): support GnuPG keybox (pubring.kbx) keyrings (#32281) ... * fix(provenance): support GnuPG keybox (pubring.kbx) keyrings Starting with GnuPG 2.1, file-backed public keyrings can use ~/.gnupg/pubring.kbx instead of the legacy pubring.gpg. Helm only read the legacy format, so chart and plugin verification failed on installations using the file-backed keybox. Make the keyring loader format-aware: - GnuPG keybox (pubring.kbx): extract OpenPGP keyblocks from the keybox container without adding a dependency. Skip ephemeral blobs, matching GnuPG's own read behavior. - ASCII-armored keyrings: load single or concatenated exports. - Legacy binary packet streams (pubring.gpg): retain the existing path. defaultKeyring() falls back to pubring.kbx when pubring.gpg is absent. pubring.gpg keeps precedence when both files exist. This change covers file-backed public keyrings. It does not read the SQLite database used by keyboxd, which needs a separate design. Related to #31836 Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> * fix(provenance): treat only not-exist as keyring absence in defaultKeyring A stat error other than 'not exist' (e.g. a permission problem) meant the file may well be present, but defaultKeyring() skipped past it: an unreadable pubring.gpg silently lost precedence to pubring.kbx, and the surfaced error could point at the wrong file. Treat only fs.ErrNotExist as absence. For any other stat error, return that path unchanged so the real error surfaces when the keyring is opened. Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> --------- Signed-off-by: Ruslan Shaydullin <shaydullin.r.d@outlook.com> Co-authored-by: George Jenkins <gvjenkins@gmail.com>	3 weeks ago
Siew Kam Onn	7c9176ae35	Update dependencies and refactor crypto imports to use ProtonMail's go-crypto package ... Signed-off-by: Siew Kam Onn <kosiew@gmail.com>	12 months ago
Adam Reese	e458a67f0c	ref(pkg/chart): add validation method to chart ... Consolidate validation of Chart.yaml. Signed-off-by: Adam Reese <adam@reese.io>	8 years ago
Adam Reese	0c6b6d1c62	fix(*): correct file permissions on source files	10 years ago
Matt Butcher	9ae97c341c	fix(helm): read passphrase from prompt ... This prompts the user to enter a passphrase if the given PGP key is encrypted. Closes #1447	10 years ago
Matt Butcher	ce83a8a777	feat(pkg/provenance): add OpenPGP signatures ... This adds support for OpenPGP signatures containing provenance data. Such information can be used to verify the integrity of a Chart by testing that its file hash, metadata, and images are correct. This first PR does not contain all of the tooling necessary for end-to-end chart integrity. It contains just the library. See #983	10 years ago